RELEASE GUIDE VirusSca Eterprise VERSION 7.0
COPYRIGHT 2003 Networks Associates Techology, Ic. All Rights Reserved. No part of this publicatio may be reproduced, trasmitted, trascribed, stored i a retrieval system, or traslated ito ay laguage i ay form or by ay meas without the writte permissio of Networks Associates Techology, Ic., or its suppliers or affiliate compaies. To obtai this permissio, write to the attetio of the Network Associates legal departmet at: 3965 Freedom Circle, Sata Clara, Califoria 95054, or call +1-972-308-9960. TRADEMARK ATTRIBUTIONS Active Firewall, Active Security, Active Security (i Katakaa), ActiveHelp, ActiveShield, AtiVirus Ayware ad desig, Bomb Shelter, Certified Network Expert, Clea-Up, CleaUp Wizard, CNX, CNX Certificatio Certified Network Expert ad desig, Desig (stylized N), Disk Mider, Distributed Siffer System, Distributed Siffer System (i Katakaa), Dr Solomo s, Dr Solomo s label, Eterprise SecureCast, Eterprise SecureCast (i Katakaa), Evet Orchestrator, EZ SetUp, First Aid, ForceField, GMT, GroupShield, GroupShield (i Katakaa), Guard Dog, HelpDesk, HomeGuard, Huter, LANGuru, LANGuru (i Katakaa), M ad desig, Magic Solutios, Magic Solutios (i Katakaa), Magic Uiversity, MagicSpy, MagicTree, McAfee, McAfee (i Katakaa), McAfee ad desig, McAfee.com, MultiMedia Cloakig, Net Tools, Net Tools (i Katakaa), NetCrypto, NetSca, NetShield, NetStalker, Network Associates, NetXray, NotesGuard, Nuts & Bolts, Oil Chage, PC Medic, PCNotary, PrimeSupport, Recoverkey, Recoverkey Iteratioal, Registry Wizard, ReportMagic, Router PM, Safe & Soud, SalesMagic, SecureCast, Service Level Maager, ServiceMagic, SmartDesk, Siffer, Siffer (i Hagul), Stalker, SupportMagic, TIS, TMEG, Total Network Security, Total Network Visibility, Total Network Visibility (i Katakaa), Total Service Desk, Total Virus Defese, Trusted Mail, UIstaller, Virex, Virus Forum, ViruSca, VirusSca, WebSca, WebShield, WebShield (i Katakaa), WebSiffer, WebStalker, WebWall, Who s Watchig Your Network, WiGauge, Your E-Busiess Defeder, ZAC 2000, Zip Maager are registered trademarks of Network Associates, Ic. ad/or its affiliates i the US ad/or other coutries. All other registered ad uregistered trademarks i this documet are the sole property of their respective owers. This product icludes or may iclude software developed by the OpeSSL Project for use i the OpeSSL Toolkit. (http://www.opessl.org/) This product icludes or may iclude cryptographic software writte by Eric Youg. (eay@cryptsoft.com) LICENSE AGREEMENT NOTICE TO ALL USERS: CAREFULLY READ THE APPROPRIATE LEGAL AGREEMENT CORRESPONDING TO THE LICENSE YOU PURCHASED, WHICH SETS FORTH THE GENERAL TERMS AND CONDITIONS FOR THE USE OF THE LICENSED SOFTWARE. IF YOU DO NOT KNOW WHICH TYPE OF LICENSE YOU HAVE ACQUIRED, PLEASE CONSULT THE SALES AND OTHER RELATED LICENSE GRANT OR PURCHASE ORDER DOCUMENTS THAT ACCOMPANIES YOUR SOFTWARE PACKAGING OR THAT YOU HAVE RECEIVED SEPARATELY AS PART OF THE PURCHASE (AS A BOOKLET, A FILE ON THE PRODUCT CD, OR A FILE AVAILABLE ON THE WEB SITE FROM WHICH YOU DOWNLOADED THE SOFTWARE PACKAGE). IF YOU DO NOT AGREE TO ALL OF THE TERMS SET FORTH IN THE AGREEMENT, DO NOT INSTALL THE SOFTWARE. IF APPLICABLE, YOU MAY RETURN THE PRODUCT TO NETWORK ASSOCIATES OR THE PLACE OF PURCHASE FOR A FULL REFUND. Issued February 2003 / VirusSca Eterprise software versio 7.0
Cotets Preface............................................... 5 Audiece............................................................... 5 Gettig more iformatio................................................... 5 Cotactig McAfee ad Network Associates.................................... 7 1 New Features.......................................... 9 Admiistratio........................................................... 9 Oe product for servers ad workstatios................................. 10 Eviromet variables................................................ 10 Repairig corrupt istalled VirusSca Eterprise files........................ 11 Microsoft Widows Server 2003 support.................................. 11 Localized operatig systems........................................... 12 Log files........................................................... 13 AVERT samples.................................................... 14 EMC Celerra ad CAVA.............................................. 14 Iterface.............................................................. 15 Access to iterface optios............................................ 15 Right-click meus................................................... 16 EXTRA.DAT iformatio i the About VirusSca Eterprise dialog box.......... 16 Task status........................................................ 17 Scaers.............................................................. 18 E-mail body scaig................................................ 18 MIME-ecoded file scaig........................................... 19 Resumig a iterrupted sca......................................... 20 Sca optios for low-risk ad high-risk processes........................... 21 Secodary actios for scas........................................... 22 AutoUpdate 7.0......................................................... 23 HotFixes ad service packs........................................... 23 Distributed update servers............................................ 25 Resumig a iterrupted update........................................ 26 Update Now commad............................................... 27 Multiple update tasks................................................ 27 Release Guide iii
Cotets 2 Chaged Features..................................... 27 Admiistratio.......................................................... 27 CPU utilizatio..................................................... 28 Password protectio................................................. 29 Alerts by compoet................................................. 30 Iterface.............................................................. 31 Start meu optios.................................................. 31 Scaers ad AutoUpdate................................................. 32 What to sca ad what ot to sca...................................... 33 Scheduled sca tasks ad update tasks.................................. 35 O-access sca messages............................................ 36 Sca optios i the user iterface....................................... 37 Archive ad compressed file scaig................................... 38 Clea file sca cache................................................ 39 3 Removed Features.................................... 39 Admiistratio.......................................................... 39 Operatig system support............................................. 40 Importig ad exportig tasks.......................................... 41 Create Emergecy Disk.............................................. 41 DMI alerts......................................................... 41 Performace couters................................................ 42 Scaers ad updates.................................................... 42 Iteret Filter....................................................... 42 Dowload Sca..................................................... 43 Exclude actio...................................................... 43 O-Demad Sca wizard............................................. 44 AutoUpgrade....................................................... 44 iv VirusSca Eterprise software versio 7.0
Preface This Release Guide itroduces McAfee VirusSca Eterprise software versio 7.0, ad describes the followig iformatio: New features i this release of the software. Chaged features i this release of the software. Removed features. Audiece This iformatio is iteded primarily for two audieces: Network admiistrators who are resposible for the compay s ati-virus ad security program. Users who are resposible for updatig virus defiitio (DAT) files o their workstatio, or cofigurig the software s detectio optios. Gettig more iformatio Product Guide Product itroductio ad features, detailed istructios for cofigurig the software, iformatio o deploymet, recurrig tasks, ad operatig procedures. Available i a Adobe Acrobat.PDF file from either the product CD or the McAfee dowload site. Istallatio Guide System requiremets ad istructios for istallig ad startig the software. Available as a prited booklet that accompaies the product CD. Also available i a Adobe Acrobat.PDF file from either the product CD or the McAfee dowload site. Release Guide 5
Preface Help Product iformatio i the Help system that is accessed from withi the applicatio. The Help system provides high-level ad detailed iformatio. Access from either a Help meu optio or Help butto i the applicatio. Cotext-sesitive (What s This?) Help provides brief descriptios of the selectios i the applicatio. Access by right-clickig o a optio, pressig the [F1] cotrol key, or draggig the questio ico to a optio. Cofiguratio Guide For use with epolicy Orchestrator. Procedures for istallig, cofigurig, deployig, ad maagig your McAfee product through epolicy Orchestrator maagemet software. Available i a Adobe Acrobat.PDF file from either the product CD or the McAfee dowload site. Release Notes README file. Product iformatio, system requiremets, resolved issues, ay kow issues, ad last-miute additios or chages to the product or its documetatio. Available as a.txt file from either the product CD or the McAfee dowload site. Cotact A list of phoe umbers, street addresses, web addresses, ad fax umbers for Network Associates offices i the Uited States ad aroud the world. Also provides cotact iformatio for services ad resources, icludig: Techical Support Customer Service Dowload Support AVERT Ati-Virus Emergecy Respose Team McAfee Beta Site O-Site Traiig Network Associates Offices Worldwide 6 VirusSca Eterprise software versio 7.0
Preface Cotactig McAfee ad Network Associates Techical Support http://kowledge.ai.com McAfee Beta Site www.mcafeeb2b.com/beta/ AVERT Ati-Virus Emergecy Respose Team www.mcafeeb2b.com/aicommo/avert/default.asp Dowload Site DAT File Updates Product Upgrades www.mcafeeb2b.com/aicommo/dowload/ www.mcafeeb2b.com/aicommo/dowload/dats/fid.asp ftp://ftp.ai.com/pub/ativirus/datfiles/4.x www.mcafeeb2b.com/aicommo/dowload/upgrade/logi.asp Valid grat umber required. Cotact Network Associates Customer Service. O-Site Traiig www.mcafeeb2b.com/services/mcafee-traiig/default.asp Network Associates Customer Service: E-mail Web services_corporate_divisio@ai.com www.ai.com www.mcafeeb2b.com US, Caada, ad Lati America toll-free: Phoe +1-888-VIRUS NO or +1-888-847-8766 Moday Friday, 8 a.m. 8 p.m., Cetral Time For additioal iformatio o cotactig Network Associates ad McAfee icludig toll-free umbers for other geographic areas see the Cotact file that accompaies this product release. Release Guide 7
Preface 8 VirusSca Eterprise software versio 7.0
New Features 1 This release of VirusSca Eterprise 7.0 is desiged for both servers ad workstatios, elimiatig the eed for two separate products. This release of VirusSca Eterprise 7.0 itroduces may ew features. These ca be divided ito four categories: Admiistratio o page 9 Iterface o page 15 Scaers o page 18 AutoUpdate 7.0 o page 23 Admiistratio The release of VirusSca Eterprise 7.0 itroduces the followig ew admiistratio features: Oe product for servers ad workstatios o page 10 Eviromet variables o page 10 Repairig corrupt istalled VirusSca Eterprise files o page 11 Microsoft Widows Server 2003 support o page 11 Localized operatig systems o page 12 Log files o page 13 AVERT samples o page 14 EMC Celerra ad CAVA o page 14 Release Guide 9
New Features Oe product for servers ad workstatios NetShield 4.5 supported oly file server cofiguratios ad VirusSca 4.5.1 supported oly workstatio cofiguratios. This required the customer to maage multiple products. Curret release VirusSca Eterprise 7.0 supports both file servers ad workstatios i oe product. Beefits Havig oe product for file servers ad workstatios provides: More efficiet use of resources durig deploymet ad cofiguratio. Cosistet iterface ad features across cofiguratios. More effective ad efficiet support. Eviromet variables You could ot use eviromet variables i path ames. Curret release You ca use eviromet variables (for example, %WINDIR%) aywhere i a path ame. For example, eviromet variables ca be used i the log file path ad sca item path, amog others. NOTE If, whe cofigurig a sca task o a remote computer, you eter a variable that does ot exist o the local computer, or does ot have a compatible value, a message appears statig that the path ame does ot appear to be valid. Beefits The ability to use eviromet variables i path ames saves you time whe cofigurig sca tasks o remote computers. 10 VirusSca Eterprise software versio 7.0
New Features Repairig corrupt istalled VirusSca Eterprise files This feature was ot available i either VirusSca 4.5.1 or NetShield 4.5. Curret release By usig Microsoft Istaller, you ca use the Repair optio i the istallatio wizard to repair ay files that have bee corrupted sice the origial istallatio. Beefits This feature allows you to repair files or the registry without havig to reistall the software. Microsoft Widows Server 2003 support Not available i either NetShield 4.5 or VirusSca 4.5.1. Curret release VirusSca Eterprise 7.0 supports the Microsoft Server 2003 RC1 operatig system (formerly kow as Widows.NET RC1). Beefits This provides aother choice of server operatig system. Release Guide 11
New Features Localized operatig systems The Eglish laguage versios of VirusSca 4.5.1 ad NetShield 4.5 would ru o oly the Eglish laguage versio of the operatig system. Curret release The Eglish laguage versio of VirusSca Eterprise 7.0 rus o localized versios of supported operatig systems. Beefits This gives the product: Wider availability ad flexibility. Compatibility with Microsoft multiligual user iterfaces (MUIs). 12 VirusSca Eterprise software versio 7.0
New Features Log files Log file size could be limited from oe to 999KB (or you could choose ot to limit the log file size). While cofigurig your log files, you could choose to iclude: Virus detectio Virus cleaig Ifected file deletio Ifected file move Sessio settigs Sessio summary Date ad time User ame Curret release Log file size ca be limited from oe to 999MB (or you ca choose ot to limit the log file size). Virus detectio, virus cleaig, ifected file deletio, ad ifected file move iformatio is logged automatically. Whe the log file reaches its limit, the first 20% of the file will be deleted to esure loggig data cotiues. While cofigurig your log file, you ca iclude the followig optioal iformatio: Sessio settigs Sessio summary Failure to sca ecrypted files This is a ew feature for the log file. User ame Beefits Icludes more iformatio i the file ad allows greater size of the file, if you choose to limit the size. Simplifies optios of what to log. Release Guide 13
New Features AVERT samples You could ot submit a virus sample directly to AVERT through the user iterface. Curret release You ca access the the AVERT WebImmue web site (www.webimmue.et) directly to submit a virus sample to AVERT. Beefits Direct access to the WebImmue web site. Where to fid From the VirsuSca Cosole, select Help Submit a Sample to AVERT. EMC Celerra ad CAVA Curret release McAfee has itegrated its VirusSca Eterprise techology with EMC s Celerra ati-virus solutio, providig customers with comprehesive, easy-to-maage, eterprise-level ati-virus protectio for their critical EMC etwork attached storage (NAS) resources. Whe a file is writte ad saved (sca o update), or first read (sca o read), the Celerra solutio restricts access to that file util virus scaig has bee performed by VirusSca. The Celerra ati-virus solutio cosolidates virus scaig o a scalable ad low overhead cofiguratio that protects busiess-critical iformatio without impedig performace. The Celerra ati-virus solutio cosists of: VirusSca Eterprise 7.0 or NetShield 4.5 The Celerra AtiVirus Aget (CAVA) 1.8.9 or later DART code 2.2.39 or later (DART 4.2 for sca o read) NOTE For Celerra NS600 hardware, DART code 5.0x ad CAVA 2.2.4 are required as a miimum. Beefits Itegratio with other products offers you greater flexibilty whe cofigurig your etwork solutio. 14 VirusSca Eterprise software versio 7.0
Iterface New Features The release of VirusSca Eterprise 7.0 itroduces the followig ew iterface features: Access to iterface optios o page 15 Right-click meus o page 16 EXTRA.DAT iformatio i the About VirusSca Eterprise dialog box o page 16 Task status o page 17 Access to iterface optios VirusSca 4.5.1 ad NetShield 4.5 did ot allow the admiistrator to limit user iterface optios for the ed user. Curret release VirusSca Eterprise 7.0 allows you to: Show the system tray ico with all meu optios. Show the system tray ico with miimal meu optios. Hide the system tray ico, so that o meu optios are available. Beefits This feature allows you to: Cofigure the product for greater security by prevetig users from turig off or alterig the ati-virus protectio o their workstatio. Have complete cotrol of user iterface visibility. Where to fid Cofigure this feature o the Display Optios tab of the User Iterface Optios dialog box. (From the VirusSca Cosole, select Tools User Iterface Optios.) Release Guide 15
New Features Right-click meus Both VirusSca 4.5.1 ad NetShield 4.5 were uable to sca top-level virtual objects, such as My Computer ad My Documets. Curret release Virus scaig of top-level virtual objects, such as My Computer ad My Documets, is ow available through right-click meus. Scaig from the right-click meus also scas files of ay type. Beefits Allows you to sca top-level virtual objects by right-clickig their icos ad selectig Sca for viruses from the meu. EXTRA.DAT iformatio i the About VirusSca Eterprise dialog box You could fid the extra driver (EXTRA.DAT) iformatio ad the umber of viruses detected by the EXTRA.DAT file oly by searchig the directory or the evet log. Curret release The About VirusSca Eterprise dialog box cotais: Iformatio regardig the EXTRA.DAT file, if preset. The umber of viruses detected by EXTRA.DAT, if preset. Beefits Durig a outbreak situatio, you ca see which computers have bee updated, ad whether the driver ca detect the virus. The EXTRA.DAT ad licese iformatio (accessible from the dialog box) is reported to epolicy Orchestrator. Where to fid Right-click the VirusSca Eterprise ico i the system tray ad select About VirusSca Eterprise, or select About from the Help meu of the VirusSca Cosole. 16 VirusSca Eterprise software versio 7.0
New Features Task status Whe a scheduled task ra, you could view oly the time at which the last task lauched. You could ot see whether the task was ruig. Curret release The VirusSca Cosole icludes a Status colum, which idicates the curret status of all tasks. Beefits Allows you to kow whether a give task is curretly ruig. Where to fid This iformatio is available i the Status colum of the VirsuSca Cosole. Release Guide 17
New Features Scaers The release of VirusSca Eterprise 7.0 itroduces the followig ew scaig features: E-mail body scaig o page 18 MIME-ecoded file scaig o page 19 Resumig a iterrupted sca o page 20 Sca optios for low-risk ad high-risk processes o page 21 Secodary actios for scas o page 22 E-mail body scaig Scaig the body of a e-mail message was ot possible i either VirusSca 4.5.1 or NetShield 4.5. Curret release The O-Delivery Scaer ad e-mail O-Demad Scaer ow iclude body scaig for HTML-based script viruses. The scaer write the body of a mail message to its ow Temporary folder as a temporary file, the scas the file. Ifected messages are embedded i a cotaier e-mail message ad moved to the iteded recipiet s ifected folder i Microsoft Outlook. Aother message is placed i the iteded recipiet s ibox, idicatig that the origial message has bee set to the ifected folder. Beefits Greater security with the e-mail sca features. Where to fid This optio is located o the Advaced tab of the O-Delivery Sca Properties ad O-Demad Sca Properties dialog boxes. The Ifected folder is located i the Folder List pae of Microsoft Outlook. 18 VirusSca Eterprise software versio 7.0
New Features MIME-ecoded file scaig MIME-ecoded (multipurpose Iteret mail extesio) files were ot scaed. The o-access scaer would sca the file oly whe the user tried to access the file, after the e-mail trasport brought the ifected file oto the system. Curret release All MIME-ecoded files are scaed by all scaers whe the Decode MIME ecoded files optio is selected. This feature ca be eabled or disabled. The O-Delivery Scaer selects this optio by default. The O-Demad Scaer ad O-Access Scaer do ot select this optio by default because some POP3 cliets store all MIME e-mail messages i a combied form. So, if oe file is ifected, VirusSca Eterprise could delete all of the icomig messages. Beefits Allows all scaers to detect ifectios iside files that are attached to icomig e-mail messages, before there is a attempt to access the file. Provides greater security with earlier detectio. Where to fid This cofiguratio optio (Decode MIME ecoded files) is located o the Advaced tab of each of the sca feature s properties dialog boxes. NOTE I order to sca archives (for example,.zip) that are attached to a.eml file, the Sca iside archives optio o this tab must also be selected. Release Guide 19
New Features Resumig a iterrupted sca Neither VirusSca 4.5.1 or NetShield 4.5 allowed the resumptio of a sca that had bee iterrupted. Curret release VirusSca Eterprise 7.0 allows the resumptio of a scheduled sca if it is iterrupted. You ca cofigure your sca task properties to iterrupt the task if it takes loger tha a defied amout of time. Whe this happes, or if a scheduled sca is iterrupted for ay reaso, the ext time the task rus, it resumes from the poit of iterruptio. Whe the sca task rus agai, regardless of reaso of the iterruptio, you are prompted to choose either to resume the sca or to start the sca from the begiig. Scheduled scas always resume sice there is o user iterface. Beefits The abilty to stop ad resume a sca coserves resources, providig a higher degree of system efficiecy. Where to fid Whe you schedule a sca task (usig the Schedule butto i the VirusSca O-Demad Sca dialog box), select Eable, ad select Stop the task if it rus for. The eter the desired hours ad miutes for the allowable amout of time to perform the sca before iterruptio. 20 VirusSca Eterprise software versio 7.0
New Features Sca optios for low-risk ad high-risk processes I both VirusSca 4.5.1 ad NetShield 4.5, sca policies were the same for all processes. Curret release The o-access scaer i VirusSca Eterprise 7.0 provides per-process cofiguratios. You ca cofigure what type of scaig to use for specific processes associated with specific applicatios. For example, you ca cofigure the scaer to use lower security settigs whe scaig files accessed by applicatios kow to be typically low-risk. The optios are: Default Processes A list of processes, ot defied as low-risk or high-risk, that use the same, cofigurable settigs. NOTE You ca apply these settigs to all processes or to oly those processes that are ot defied as low-risk or high-risk. Low-Risk Processes Custom cofiguratio settigs for low-risk processes. High-Risk Processes Custom cofiguratio settigs for high-risk processes. Beefits This feature allows greater admiistrative cotrol by providig a flexible method for admiistrators to customize the scaig of processes to esure maximum performace ad risk mitigatio. Where to fid This feature is located o the VirusSca O-Access Sca Properties dialog box, i the properties for Low-Risk Processes ad High-Risk Processes. Cofigure the settigs for each set of processes o the Detectio, Advaced, ad Actios tabs o the respective sectios (Default Processes, Low-Risk Processes, ad High-Risk Processes) of the VirusSca O-Access Sca Properties dialog box. Release Guide 21
New Features Secodary actios for scas I both VirusSca 4.5.1 ad NetShield 4.5, you could ot defie a secodary actio for the scaer to take if the selected actio failed. Curret release VirusSca Eterprise 7.0 allows you to defie a primary ad secodary actio for the scaer to take whe it detects a ifected file. If the primary actio fails, VirusSca attempts the secodary actio before promptig the user. If the secodary actio fails, the error is logged ad a alert is set but the user is ot prompted. Beefits Havig a predefied secodary actio for ifected files gives you greater cotrol ad fewer iterruptios. Where to fid Defie the primary ad secodary actios for o-access scas o the Actios tab of the VirusSca O-Access Sca Properties dialog box for each optio (Default Processes, Low-Risk Processes, ad High-Risk Processes) i the list view of this dialog box. 22 VirusSca Eterprise software versio 7.0
AutoUpdate 7.0 New Features The release of VirusSca Eterprise 7.0 itroduces the followig ew update features: HotFixes ad service packs o page 23 Distributed update servers o page 25 Resumig a iterrupted update o page 26 Update Now commad o page 27 Multiple update tasks o page 27 HotFixes ad service packs With both NetShield 4.5 ad VirusSca 4.5.1, you could use the AutoUpdate compoet to dowload: DAT files Scaig egies Updates were retrieved from a UNC share, a FTP server, or a local path/mapped drive. Curret release AutoUpdate 7.0 i VirusSca Eterprise 7.0 dowloads the followig: DAT files EXTRA.DAT files Scaig egies Service packs HotFixes Updates are retrieved from a UNC share, FTP server, HTTP server, mapped drive, or local drive. Release Guide 23
New Features Beefits Improves update reliability. Simplifies the deploymet of service packs, HotFixes, ad EXTRA.DAT files for the most curret software. Gives greater flexibility, by providig a additioal dowload server type. Where to fid You ca schedule a update o the VirusSca Cosole by selectig Task New Update task, or by schedulig the default AutoUpdate task i the VirusSca Cosole. 24 VirusSca Eterprise software versio 7.0
New Features Distributed update servers With both VirusSca 4.5.1 ad NetShield 4.5, you could oly update via a FTP server, a UNC share, or a local path/mapped drive. VirusSca 4.5.1 allowed updatig to a mirror site o a cliet computer. This allowed retrievig VirusSca software updates from a local cliet computer. However, this method had limitatios because it had to be set up o a cliet computer istead of a server. Curret release A ew compaio utility, McAfee AutoUpdate Architect software versio 1.0, allows you to cofigure ad use distributed update servers. These are servers distributed o your etwork from which you ca retrieve software updates. VirusSca Eterprise 7.0 ca update from a selectio of iteral servers ad server types: HTTP servers. FTP servers (either passive or active). UNC share servers. Local drive. Mapped drive. NOTE With McAfee AutoUpdate Architect, VirusSca Eterprise 7.0 ca commuicate with the distributed update servers durig a update, to determie which server provides the fastest dowload, ad ca update from that server. If oe of the iteral update servers are available, the AutoUpdate utility dowloads from ftp://ftp.ai.com/commoupdater. Beefits Coservatio of badwidth of both the local area etwork (LAN) ad wide area etwork (WAN). Greater flexibility whe choosig servers. Updates for both servers ad workstatios from local servers. Where to fid The AutoUpdate repository list ca be cofigured through the Tools Edit AutoUpdate Repository List meu from the VirusSca Cosole. Release Guide 25
New Features Resumig a iterrupted update Neither VirusSca 4.5.1 or NetShield 4.5 allowed the resumptio of a update task that had bee iterrupted. Curret release VirusSca Eterprise 7.0 allows the resumptio of a update if it is iterrupted. You ca cofigure your update task properties to iterrupt the task if it takes loger tha a defied amout of time. Whe this happes, or if a update is iterrupted for ay reaso, the ext time the task rus, it resumes from the poit of iterruptio. Beefits Beig able to stop ad resume a update coserves resources, providig a higher degree of system efficiecy. Where to fid Whe you schedule a update task (usig the Task New Update task commad i the VirusSca Cosole), select Eable, ad Stop the task if it rus for. The eter the desired hours ad miutes for the allowable amout of time to perform the update before iterruptio. 26 VirusSca Eterprise software versio 7.0
New Features Update Now commad Havig a sigle commad to perform a comprehesive update was ot available i NetShield 4.5 or VirusSca 4.5.1. Updatig was oly available by ruig a task from the cosole. Curret release VirusSca Eterprise 7.0 allows you to update the DAT files by clickig Update Now. NOTE Access to this feature is cotrolled by the admiistrator. Beefits You ca ru a update more easily. Where to fid Right-click the VirusSca ico i the system tray ad select Update Now, or ope a existig update task ad click Update Now, or select Tools New Update Task i the VirusSca Cosole. Multiple update tasks I both VirusSca 4.5.1 ad NetShield 4.5, you could schedule oly oe update task ad oe upgrade task. Curret release VirusSca Eterprise 7.0 allows you to create ad schedule multiple update tasks i the VirusSca Cosole. (There are o upgrade tasks upgrades are performed with update tasks.) You ca cofigure separate update tasks for servers ad workstatios, each with its ow optios ad schedule. Beefits This allows you greater cotrol over your eterprise eviromet. Where to fid I the VirusSca Cosole, select Tools New Update Task. Release Guide 27
New Features 28 VirusSca Eterprise software versio 7.0
Chaged Features 2 While most features of the VirusSca 4.5.1 ad NetShield 4.5 products were retaied i VirusSca Eterprise 7.0, some features are ow located i differet areas of the product ad require differet actios to use them. These ca be divided ito three categories: Admiistratio o page 27 Iterface o page 31 Scaers ad AutoUpdate o page 32 Admiistratio The release of VirusSca Eterprise 7.0 icludes the followig chaged admiistratio features: CPU utilizatio o page 28 Password protectio o page 29 Alerts by compoet o page 30 Release Guide 27
Chaged Features CPU utilizatio s I NetShield 4.5, you could use the Sca priority slider to set the limit of CPU utilizatio that a sca task could use. However, there were five pre-set optios oly; you could ot select a specific percetage of CPU utilizatio for sca tasks. VirusSca 4.5.1 did ot iclude a feature i the user iterface to defie maximum CPU utilizatio. You had to chage the value i the registry maually. Curret release You ca specify a allowable average percetage of CPU utilizatio for a o-demad sca. You ca select from 10% to 100% utilizatio i icremets of 10. Beefits You have more flexibility i cofigurig o-demad scas ad more cotrol of system resources. Where to fid O the Advaced tab of the VirusSca O-Demad Sca Properties dialog box, uder CPU utilizatio. 28 VirusSca Eterprise software versio 7.0
Chaged Features Password protectio I VirusSca 4.5.1, the security password did ot apply to all optios. Users still had cotrol over some idividual tabs ad optios. Curret release Password protectio is ow per task item. You ca set or clear oe password for access to specified VirusSca Eterprise features. Password optios are: No password No password is set ad all features ad user iterface are available. Password protectio for all items listed below Set a password that secures all the items listed o the Password Optios tab of the User Iterface Optios dialog box. Password protectio for the selected items below Set a password ad select which items you wat password-protected. Optios of the followig features ca be password protected: O-Access Sca O-Demad Sca Saved Tasks O-Demad Sca Usaved Tasks E-Mail Sca O-Delivery E-Mail Sca O-Demad AutoUpdate Alert Maager Cliet Cosole ad Miscellaeous If the password is set users must eter the password. Admiistrators ca lock or ulock the user iterface by selectig Tools Ulock User Iterface from the VirusSca Cosole to access locked items. Beefits Password protectio offers better security by prevetig admiistrators (or users with local admiistrator rights) without the password from cofigurig the product. Where to fid Set the password by selectig Tools User Iterface Optios from the VirusSca Cosole. Release Guide 29
Chaged Features Alerts by compoet VirusSca 4.5.1 allowed the user who started a o-demad sca to choose whether a ifectio alerted the Alert Maager utility. Curret release VirusSca Eterprise 7.0 allows oly admiistrators to set which VirusSca compoets geerate alerts. Therefore, users caot decide whether a alert is geerated if a virus is detected o their computers. Beefits Admiistrator-cotrolled alert geeratio allows better security. If admiistrators cofigure alerts to be set to the Alert Maager, they ca collect iformatio by VirusSca Eterprise feature o all viruses foud i the orgaizatio. Where to fid O the Alert Maager Alerts tab of the Alert Properties dialog box. (Select Tools Alerts o the VirusSca Cosole.) 30 VirusSca Eterprise software versio 7.0
Iterface Chaged Features This release of VirusSca Eterprise 7.0 icludes the followig chaged iterface feature: Start meu optios o page 31 Start meu optios Previously, the Start meu shortcuts icluded: Create Emergecy Disk VirusSca VirusSca Alertig Cofiguratio VirusSca Cosole Curret release I VirusSca Eterprise 7.0, the Start meu shortcuts iclude: VirusSca Cosole VirusSca O-Access Sca VirusSca O-Demad Sca Alert Maager Cofiguratio Alert Maager Messages NOTE The Alert Maager shortcuts are preset oly if the Alert Maager software is istalled. Each shortcut lauches its respective property dialog boxes, but does ot lauch scas. Beefits These shortcuts allow you quick access to all the property dialog boxes withi VirusSca Eterprise 7.0, except the O-Delivery Sca. Where to fid Select Start Programs Network Associates. Release Guide 31
Chaged Features Scaers ad AutoUpdate This release of VirusSca Eterprise 7.0 icludes the followig scaig ad updatig chaged features: What to sca ad what ot to sca o page 33 Scheduled sca tasks ad update tasks o page 35 O-access sca messages o page 36 Sca optios i the user iterface o page 37 Archive ad compressed file scaig o page 38 Clea file sca cache o page 39 32 VirusSca Eterprise software versio 7.0
Chaged Features What to sca ad what ot to sca VirusSca 4.5.1 icluded differet dialog boxes for o-access scas ad o-demad scas whe cofigurig which file types to sca. I both NetShield 4.5 ad VirusSca 4.5.1, you defied what ot to sca o a separate Exclusios tab. You could cofigure what to sca for o-access scas ad o-demad scas with these optios: Default files All files User specified files I VirusSca 4.5.1, two lists of default file type were available, but ot clearly separated o the iterface. Oe list used defaults from the DAT files, ad oe used product defaults. You could ot customize the DAT file type defaults, but you could customize the product file type defaults. Curret release Cofigurig what to sca ad what ot to sca takes place o the same iterface. Although the iterfaces are early idetical for both o-access scas ad o-demad scas, you must set them up idepedetly. Selectios of what to sca iclude: All files Default + additioal file types Specified file types Selectios of what ot to sca iclude: Specific files, folders or drives File types File age Files protected by Widows File Protectio VirusSca Eterprise 7.0 has a sigle list of default file types available. This list comes from the DAT files ad caot be customized. You ca also add file types to the default list, or use a completely user-specified list of file types. Release Guide 33
Chaged Features Beefits Easier cofiguratio of what to iclude, ad what ot to iclude sice they both take place o the same tab of the dialog boxes. A sigle list of default file types provides greater cosistecy. The ability to choose what ot to sca provides greater admiistrative cotrol. Greater admiistrative cotrol sice o oe ca customize the list of default file types. Where to fid Located o the Detectio tab of the VirusSca O-Demad Sca dialog box ad o the Detectio tab of the Default Processes or All Processes sectios of the VirusSca O-Access Sca Properties dialog box. 34 VirusSca Eterprise software versio 7.0
Chaged Features Scheduled sca tasks ad update tasks The optios for cofigurig whe to ru a scheduled task were: Oce At Startup Hourly Daily Weekly Mothly Curret release VirusSca Eterprise 7.0 provides greater flexibility for the existig optios, ad adds these ew optios: At Logo Whe Idle Ru Immediately Ru o Dialup Beefits These task schedulig optios provide greater flexibility whe schedulig tasks. Where to fid For o-demad sca tasks, click Schedule o the VirusSca O-Demad Sca Properties dialog box, the select the Schedule tab of the Schedule Settigs dialog box. For update tasks, click Schedule o the VirusSca AutoUpdate Properties dialog box, the select the Schedule tab of the Schedule Settigs dialog box. Release Guide 35
Chaged Features O-access sca messages VirusSca 4.5.1 icluded the Prompt for Actio dialog box. If Prompt for Actio was selected as the actio for the scaer to take whe it foud a ifected file, the Prompt for Actio dialog box appeared, allowig users to decide what actio to take o the virus whe it was discovered. Curret release Whe the o-access scaer detects a ifectio, the VirusSca O-Access Sca Message dialog box appears with the ifectio details. If aother ifectio is detected, it is added to the list pae. The O-Access Sca Message dialog box lists all ifected files detected o the system. This dialog box provides the followig iformatio: Name I Folder Detected As Detectio Type Status Details what actios were attempted ad if either actio was successful. Date ad Time Applicatio Userame Admiistrator oly. Cliet ID Admiistrator oly. The O-Access Sca Message dialog box lets you select a actio with commad buttos such as, Delete or Move. If a commad is ot available, the butto is disabled. NOTE I a termial server eviromet, this dialog box allows admiistrators the ability to act o all users files, while users are restricted to actig o their ow files. Beefits Provides a higher level of detail for all curret o-access sca messages. 36 VirusSca Eterprise software versio 7.0
Chaged Features Sca optios i the user iterface VirusSca 4.5.1 had certai sca optios that you could cofigure i the user iterface: Sca exit mode Soud alert o ifectio Custom message i the prompt dialog box Curret release I VirusSca Eterprise 7.0: Sca exit mode Ca be set by a admiistrator with a registry key. Custom message i the prompt dialog box Ca be set i the user iterface o the Messages tab of the O-Acess Sca Properties dialog box. This is for o-access scas oly. Beefits Gives admiistrators greater cotrol over the sca optios. Release Guide 37
Chaged Features Archive ad compressed file scaig The McArchive utility performed scas o archives ad compressed files, but was uable to sca all types of archive ad compressed files. McArchive was also oly able to sca oe layer deep ito directories cotaied withi archives. Scaig archives ad compressed files were cotrolled by the same optios. Curret release VirusSca Eterprise 7.0 uses the latest scaig egie to sca archives ad compressed files. Archive scaig ad compressed file scaig are o loger cotrolled by the same settig, but are ow cofigured separately. Beefits The latest scaig egie supports a greater umber of archive formats, scas more efficietly tha McArchive, ad is able to sca all layers cotaied withi archives. 38 VirusSca Eterprise software versio 7.0
Chaged Features Clea file sca cache With VirusSca 4.5.1, you could ot idetify files that had already bee scaed. Therefore, whe a sca was performed, all files (accordig to the cofiguratio) were rescaed. NetShield 4.5 for Widows NT Server ad VirusSca 4.5.1 for NT Workstatio idetified which files had already bee scaed (ad had ot bee modified sice the last sca) by usig a clea file sca cache. If a file was determied to be clea, its ame ad attributes was stored i the clea file sca cache. A file was ot scaed agai util its attributes chaged. However, the clea file sca cache was small for a file server, used excessive memory, ad was located i the scaer. Curret release VirusSca Eterprise 7.0 also idetifies which files have already bee scaed (ad have ot bee modified sice the last sca) by usig a clea file sca cache. However, the clea file sca cache: Uses less memory to store each file s attributes. Is larger (about 1,000,000 etries). Is located i a driver istead of the scaer. Beefits Scaig performace is faster ad uses fewer system resources. Release Guide 39
Chaged Features 40 VirusSca Eterprise software versio 7.0
Removed Features 3 With the combiatio of VirusSca ad NetShield, several features were removed. These ca be divided ito two categories: Admiistratio o page 39 Scaers ad updates o page 42 Admiistratio The followig admiistratio features were removed for VirusSca Eterprise 7.0: Operatig system support o page 40 Importig ad exportig tasks o page 41 Create Emergecy Disk o page 41 DMI alerts o page 41 Performace couters o page 42 Release Guide 39
Removed Features Operatig system support VirusSca 4.5.1 supported workstatio platforms ruig these Microsoft operatig systems: Widows 95 Widows 98 Widows ME Widows NT 4.0 Workstatio Widows 2000 Professioal Widows XP NetShield 4.5 supported server platforms ruig these Microsoft operatig systems: Widows NT 4.0 Server ad Termial Server Widows 2000 Server ad Advaced Server Curret release VirusSca Eterprise 7.0 supports both workstatio ad server platforms ruig these Microsoft operatig systems: Widows NT 4.0 Workstatio, Server, ad Termial Server Widows 2000 Professioal, Server, ad Advaced Server Widows XP Home ad Professioal Widows Server 2003 RC1 (formerly kow as Widows.NET) Beefits Oe product supportig both workstatio ad server platforms provides: Cosistet features, fuctioality, ad iterface. Easier maiteace ad support. 40 VirusSca Eterprise software versio 7.0
Removed Features Importig ad exportig tasks You could import ad export tasks to ad from a locatio outside the VirusSca Cosole. Curret release Tasks caot be imported to, or exported from a locatio outside of the VirusSca Cosole. The removal of this feature was ecessary for compatibility issues. Create Emergecy Disk VirusSca 4.5.1 allowed you to create a emergecy disk at ay time. Curret release This is ot available through VirusSca Eterprise 7.0. However, you ca use the CleaBoot 1.0 utility, located o the product CD, to create a boot disk. DMI alerts You could sed a desktop maagemet iterface (DMI) alert idepedetly of Alert Maager. Curret release Alert Maager geerates all alerts. DMI is ot supported by the latest versio of Alert Maager. Beefits With Alert Maager geeratig all alerts, you have greater cotrol over which evets geerate a alert. Release Guide 41
Removed Features Performace couters Both VirusSca 4.5.1 ad NetShield 4.5 istalled the performace couters by default. Curret release The performace couter files are copied to the hard drive by default, but are ot istalled. The performace couters ca be istalled maually. Scaers ad updates The followig scaer ad update features have bee removed from VirusSca Eterprise 7.0: Iteret Filter o page 42 Dowload Sca o page 43 Exclude actio o page 43 O-Demad Sca wizard o page 44 AutoUpgrade o page 44 Iteret Filter The Iteret Filter was based o a outdated model. The Iteret Filter blocked Java applets, ActiveX scripts, URLs, ad IP addresses. Curret release VirusSca Eterprise 7.0 does ot block Java applets or ActiveX scripts, but its o-access scaig provides equivalet scaig protectio agaist these threats. URL ad IP address blockig fuctioality is ot replaced. Beefits Removig the Iteret Filter provides better performace ad more efficiet use of system resources. 42 VirusSca Eterprise software versio 7.0
Removed Features Dowload Sca Through Dowload Sca, the user could select a differet set of sca optios for a collectio of programs (for example, browsers, or POP3 cliets) that are capable of itroducig ew ifectios to a protected system. The admiistrator did ot have the ability to set differet scaig optios for differet processes. Curret release The scaig egie has bee exteded to allow users to set differet sca optios for three classes of processes: Default Low-Risk High-Risk NOTE For more iformatio o usig these features, see Sca optios for low-risk ad high-risk processes o page 21. Beefits Fewer compoets to maage ad cofigure. Greater admiistrative cotrol. More cotrol whe scaig differet processes. Exclude actio VirusSca 4.5.1 ad NetShield 4.5 allowed users to access files that the scaer idicated were ifected. This was doe by selectig Exclude whe defiig what actio to take o ifected files. Curret release There is o Exclude actio available. Beefits Elimiatig this optio allows less access to ifected files. Release Guide 43
Removed Features O-Demad Sca wizard Whe settig up a o-demad sca, the user could work step-by-step through the sca task setup with a wizard. Curret release Users set up the o-demad sca with the tabs ad optios provided i the VirusSca O-Demad Sca Properties dialog box. AutoUpgrade The AutoUpgrade compoet was used to update DAT files ad the egie. The AutoUpgrade compoet was used to update HotFixes ad service packs. Curret release AutoUpdate dowloads: DAT files EXTRA.DAT files Scaig egies HotFixes Service packs NOTE Although AutoUpdate dowloads HotFixes ad service packs to the cliet computer, they must be put o the server maually. The istallatio to the cliet computer will happe automatically whe AutoUpdate executes. Beefits Havig oe feature provide all updates, gives you a more efficiet product. 44 VirusSca Eterprise software versio 7.0